Does that convey a legitimate extension that was compromised (in what way?)?

Or a VSCode extension that is inherently malicious?

I feel like there's an important difference.